Hammock Sub-processors
Draft, pending launch and legal review. Highlighted items in brackets have not been confirmed. This draft creates no obligation.
Version 2.0 · Last updated [date]
This page lists the third parties that PXA LLC dba Hammock (“Hammock”) uses to process Client Data in providing the Services (sub-processors), and separately the systems Clients choose to connect (integrations). It is referenced by our Privacy Policy, Technology & Data Use Addendum, and Data Processing Addendum.
Change notices. We give at least 30 days’ notice before a new or replaced sub-processor begins processing Client Data, by updating this page and emailing subscribers. To subscribe, or to object on reasonable data-protection grounds, email privacy@gethammock.com. Prior versions of this page are archived at gethammock.com/legal/archive.
Infrastructure and platform
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Google Cloud Platform / Firebase (Google LLC) | Cloud hosting, database, file storage, authentication, secrets, logging for the Platform and Hammock’s internal services | All Client Data categories at rest and in transit | United States |
| Cloudflare, Inc. | Hosting and delivery of gethammock.com | Website visitor data (IP, request logs) | Global edge; United States |
AI and document processing
| Sub-processor | Purpose | Data processed | Training on your data? | Region |
|---|---|---|---|---|
| Google Cloud (Document AI / Vision) | Optical character recognition and document extraction | Uploaded documents and receipts | No | United States |
| Google Cloud (Vertex AI / Gemini) | Generative AI for the Eirene assistant and internal workflows | Prompts and inputs needed to produce output | No | United States |
| Anthropic, PBC | Generative AI, summarization, classification, assistant responses (API and business accounts with training disabled) | Prompts and inputs needed to produce output | No — contractually prohibited | United States |
| OpenAI, L.L.C. | Generative AI and embeddings — approved; not currently active | Prompts and inputs needed to produce output, when activated | No — API terms | United States |
| Recall.ai, Inc. | Meeting recording and transcription (with participant consent) | Meeting audio and transcripts; participant names | No | United States |
Our AI sub-processors process Client Data only to return results and for limited security and abuse monitoring, and are contractually prohibited from using it to train or improve their own models.
Payments and financial data
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Stripe, Inc. | Subscription billing and Platform payments (including Stripe Connect) | Billing contact and payment details (card data held by Stripe) | United States |
| Plaid Inc. | Bank and card account connections for the Platform (planned) | Account and transaction data you authorize; masked account identifiers | United States |
| PayPal, Inc. | Payment and payout processing in the Platform | Payment and payee details | United States |
| Bill.com, LLC | Accounts-payable and payment processing on Clients’ behalf (in the Client’s own Bill.com account) | Vendor, bill, and payment details | United States |
Communications and operations
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Google Workspace (Google LLC) | Email, documents, calendar, and video meetings used by Hammock personnel; restricted per-client folders | Communications and files related to the Services | United States |
| Slack Technologies, LLC | Internal and Client-channel messaging; the Eirene Slack app | Messages and files shared in Slack (no Sensitive HR Data by policy) | United States |
| Zoom Video Communications, Inc. | Video meetings | Meeting content; participant names | United States |
| Resend, Inc. | Transactional email from the Platform | Email addresses and notification content | United States |
| Expo (650 Industries, Inc.) | Mobile push notifications for Atlas | Device tokens and notification content | United States |
| Functional Software, Inc. (Sentry) | Error monitoring for the Platform | Diagnostic data (personal data scrubbed where possible) | United States |
| HubSpot, Inc. | Website forms and lead management | Website form submissions (name, email, company, message) | United States |
Client-elected tools
Some Clients prefer to share files through their own Dropbox or similar storage. When a Client elects that, the tool is the Client’s provider, used under the Client’s account and terms; it is not a Hammock sub-processor.
Integrations (systems Clients connect or that Hammock works in on the Client’s behalf)
These are the Client’s own providers, governed by the Client’s agreements with them. Hammock accesses them through accounts the Client controls.
| Category | Examples |
|---|---|
| Accounting and practice management | QuickBooks Online (Intuit), Centerbase |
| Commerce and marketplaces | Shopify, Grubhub, Uber Eats |
| Banking and payments | Clients’ banks and card providers; Bill.com (Client accounts) |
| Payroll, HRIS, benefits, and recruiting | Clients’ platforms (for example, Gusto, ADP, Rippling, Justworks, Lattice, Greenhouse) |
| Sales tax filing | State tax portals; Hammock’s tax-compliance technology (Avalara) [CONFIRM product] |
| Sign-in | Google, Apple |
Personnel
Hammock’s Services are performed by Hammock employees and contractors in the United States, bound by confidentiality and data-handling obligations. Software development support is provided by an offshore development partner (Emapta, Philippines) that works only in development and test environments and has no access to production Client Data.
Questions: privacy@gethammock.com